Chainwrit

Security and compliance teams can lose provenance as screenshots, configuration exports, policies, packet captures and reports move through folders and assessment workspaces. The supplied research confirms a free public transparency-log interface, a free public timestamping primitive, an adjacent assessor-led pre-assessment service and no reviewed API-first product combining per-artifact receipts with defense-compliance vocabulary. Free primitives are direct substitutes for much of the cryptography, so product value must come from safe packaging, metadata governance and verification workflow.

Chainwrit would calculate an artifact digest, bind it to a tenant, source assertion, capture time, control tag, signer and key version, place the receipt in an append-only batch and preserve its inclusion proof and external timestamp anchor. A verification endpoint would recompute the digest and report signature validity, log inclusion, timestamp observation, revocation state and missing metadata without exposing the artifact itself.

A matching digest proves only that supplied bytes match the recorded bytes. A valid signature identifies a key operation, not a truthful author or authorized collection. A timestamp bounds when a digest was observed; it does not establish when the underlying event happened. Log inclusion does not prove completeness, chain of custody, control operation, assessor acceptance, legal admissibility or compliance with any framework. Those meanings require source evidence and qualified review.

Public verification can leak client names, control posture, timing or artifact existence. The pilot should use opaque identifiers, minimize metadata, separate public proof from private evidence, rotate and revoke keys and define availability and retention. Sensitive or classified material needs an architecture and authority review before use; the initial pilot should exclude it. The buyer hypothesis is a security evidence platform, managed compliance provider, defense contractor or assessment team, but buyer role, environment classification, control taxonomy, budget, current signing practice and assessor demand require validation.

A security evidence platform, managed compliance provider, defense contractor or assessment team needing independently checkable artifact integrity receipts.